coulomb/access-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

FLEX-WP-0036: binary renamed to access-engine; flex-auth is a stub naming the rename (FLEX-DEC-2026-020)
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
Build and Publish Container Image / build-and-push (push) Successful in 1m27s
Details

Browse source 
- cmd/flex-auth -> cmd/access-engine; usage and serving lines say access-engine
- cmd/flex-auth: prints the rename and exits 2, with a test
- image: entrypoint /usr/local/bin/access-engine, flex-auth stub alongside;
  live pins pass only args, so their next roll is unaffected
- Makefile, CI, verify-posture, tenancy.yaml, live docs updated; workplans,
  decisions and ADRs left as written
- runtime names (module, audience, k8s, image package, /opt paths) unchanged

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 735967@bnt-lap001
Assistant-Session: 5971967f-77f8-4ced-9e02-c6ef67040ffc
This commit is contained in:
tegwick 2026-10-10 13:26:19 +02:00
parent c284344925
commit 0ced2995ee
36 changed files with 1268 additions and 1178 deletions
Download patch file Download diff file Expand all files Collapse all files

20
examples/tenant-engine/README.md
View file

@ -12,8 +12,8 @@ protected-system consumer, gating its own write API
| `subject_manifest.yaml` | Two registered callers: `tenant-engine` (all nine actions) and `flex-auth` (read-only on `tenant.guardrail.read`) |
| `policy_package.md` | Rego rules + embedded tests gating the write API. v3 states the tenant relation (`TEN-DEC-2026-002`, `FLEX-DEC-2026-016`): `tenant` is the target record and must equal `resource.id` (`tenant_not_target` otherwise); the scope is cross-tenant by design |
| `policy_fixtures.yaml` | Allow/deny request/decision pairs, referenced by `policy_package.md`'s frontmatter. `tenant` varies across four tenants so the suite reports on the field |
| `registry_snapshot.json` | Merged `systems`/`subjects`/`groups` snapshot assembled from the two manifests above, loadable by `flex-auth serve`/`check`/`load-registry` |
| `check_request_allow_create.json`, `check_request_deny_unknown_subject.json`, `check_request_allow_retire.json`, `check_request_deny_misspelled_lifecycle.json`, `check_request_allow_guardrail_read.json`, `check_request_allow_guardrail_set.json`, `check_request_deny_guardrail_set_as_reader.json`, `check_request_deny_misspelled_guardrail.json`, `check_request_deny_tenant_not_target.json` | Standalone example requests for `flex-auth check` |
| `registry_snapshot.json` | Merged `systems`/`subjects`/`groups` snapshot assembled from the two manifests above, loadable by `access-engine serve`/`check`/`load-registry` |
| `check_request_allow_create.json`, `check_request_deny_unknown_subject.json`, `check_request_allow_retire.json`, `check_request_deny_misspelled_lifecycle.json`, `check_request_allow_guardrail_read.json`, `check_request_allow_guardrail_set.json`, `check_request_deny_guardrail_set_as_reader.json`, `check_request_deny_misspelled_guardrail.json`, `check_request_deny_tenant_not_target.json` | Standalone example requests for `access-engine check` |
**No `resource_manifest.yaml`** — unlike ops-warden's fixed SSH-certificate
inventory, `tenant-engine`'s resources (tenants) are created dynamically.
@ -23,26 +23,26 @@ omission, not an oversight.
## Verified
```bash
go build -o bin/flex-auth ./cmd/flex-auth
go build -o bin/access-engine ./cmd/access-engine
# Rego rules + embedded tests + fixtures, all pass:
bin/flex-auth test-policy -file examples/tenant-engine/policy_package.md
bin/access-engine test-policy -file examples/tenant-engine/policy_package.md
# Registry loads cleanly:
bin/flex-auth load-registry -file examples/tenant-engine/registry_snapshot.json
bin/access-engine load-registry -file examples/tenant-engine/registry_snapshot.json
# Individual requests via the CLI:
bin/flex-auth check \
bin/access-engine check \
-registry examples/tenant-engine/registry_snapshot.json \
-policy examples/tenant-engine/policy_package.md \
-request examples/tenant-engine/check_request_allow_create.json
# End-to-end over real HTTP: a live `flex-auth serve` loaded with this
# End-to-end over real HTTP: a live `access-engine serve` loaded with this
# exact registry+policy, hit by tenant-engine's actual
# FlexAuthCheckClient/FlexAuthWriteAuthorizer (not a mock) --
# POST /tenants with actor="ops" -> 403 (unknown_subject);
# actor="tenant-engine" -> 201 (write_api_policy_matched).
bin/flex-auth serve -addr 127.0.0.1:9098 \
bin/access-engine serve -addr 127.0.0.1:9098 \
-registry examples/tenant-engine/registry_snapshot.json \
-policy examples/tenant-engine/policy_package.md
# (from tenant-engine's own checkout)
@ -54,7 +54,7 @@ TENANT_ENGINE_FLEX_AUTH_URL=http://127.0.0.1:9098 make run
`test-policy` reports **11/11 Rego tests and 16/16 fixtures passing**, the
registry loads, and `go test ./...` / `gofmt` / `go vet` are clean.
End-to-end over real HTTP: a live `flex-auth serve` on `127.0.0.1:9098`
End-to-end over real HTTP: a live `access-engine serve` on `127.0.0.1:9098`
loaded with this registry and policy, and a real `tenant-engine`
(`TENANT_ENGINE_FLEX_AUTH_URL=http://127.0.0.1:9098`) driven through its
unmodified `FlexAuthWriteAuthorizer` with `Idempotency-Key` and an `If-Match`
@ -96,7 +96,7 @@ Rollback target is `sha256:c25fc34a…` (four-action).
registry loads (2 subjects, 2 groups), and `go test ./...` / `gofmt` /
`go vet` are clean.
End-to-end over real HTTP: a live `flex-auth serve` on `127.0.0.1:9098`
End-to-end over real HTTP: a live `access-engine serve` on `127.0.0.1:9098`
loaded with this registry and policy, and a real `tenant-engine`
(`TENANT_ENGINE_FLEX_AUTH_URL=http://127.0.0.1:9098`) driven through its
unmodified `FlexAuthWriteAuthorizer`: